CERT24CVE-2026-59158 — Nuxt Ollama public runtime configuration discloses the configured cloud API keyLoading data…
CERT24Threat Observatory
Period

CVE-2026-59158 — Nuxt Ollama public runtime configuration discloses the configured cloud API key

nuxt-ollama version 1.2.26 unconditionally merges all module options, including api_key, into Nuxt's public runtime configuration. Nuxt embeds this key in the window.__NUXT__ script block of the SSR HTML response, allowing any unauthenticated HTTP client to retrieve it with a single GET request.

← Back to intelligence

CVE-2026-59158 — Nuxt Ollama public runtime configuration discloses the configured cloud API key

nuxt-ollama version 1.2.26 unconditionally merges all module options, including api_key, into Nuxt's public runtime configuration. Nuxt embeds this key in the window.__NUXT__ script block of the SSR HTML response, allowing any unauthenticated HTTP client to retrieve it with a single GET request.